beacon endpoint sentinel

Forwarding command

Use beacon endpoint sentinel to generate Microsoft Sentinel forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and gets runtime.jsonl into a Log Analytics custom table through a Data Collection Rule, either with Azure Monitor Agent or with the Vector that ships with Beacon and the Logs Ingestion API. The Vector path needs no Azure Arc. beacon endpoint sentinel forwarder runs that Vector as a system service on macOS, Linux and Windows. Its settings and Entra credential stay in a directory of its own that only root can read (SYSTEM and Administrators on Windows), never in Beacon’s config.json.

Command syntax

beacon endpoint sentinel [command]

Commands

beacon endpoint sentinel print-config

Print the Sentinel DCR transform for Beacon endpoint events.

beacon endpoint sentinel install-pack

Write Microsoft Sentinel forwarding content to a directory.

beacon endpoint sentinel validate

Write and describe a Beacon Microsoft Sentinel validation event.

beacon endpoint sentinel forwarder

Run Vector as a system service that sends the runtime log to Sentinel.

Runtime log paths

Mode	Path
User mode	`~/.beacon/endpoint/logs/runtime.jsonl`
System mode, macOS and Linux	`/var/log/beacon-agent/runtime.jsonl`
System mode, Windows	`C:\ProgramData\Beacon\Endpoint\logs\runtime.jsonl`

beacon endpoint sentinel print-config

beacon endpoint sentinel print-config prints the KQL transform used by the Microsoft Sentinel Data Collection Rule. The output starts with the Azure Monitor Agent file pattern selected from the active Beacon runtime log path.

Print the configuration

beacon endpoint sentinel print-config

Use this command when you want to inspect or copy the transform into an existing DCR workflow.

Examples

Print the DCR transform for the default per-user Beacon install:

Print the DCR transform for the default per-user Beacon install

beacon endpoint sentinel print-config

Print the DCR transform for a system-mode MDM deployment:

Print the DCR transform for a system-mode MDM deployment

sudo /opt/beacon/bin/beacon endpoint sentinel print-config --system

Print the DCR transform for a custom runtime log:

Print the DCR transform for a custom runtime log

beacon endpoint sentinel print-config --log-path /path/to/runtime.jsonl

Flags

Flag	Description
`--user`	Use per-user endpoint paths. Enabled by default
`--system`	Use system endpoint paths and launch daemon
`--log-path <path>`	Runtime JSONL log path

beacon endpoint sentinel install-pack

beacon endpoint sentinel install-pack writes Microsoft Sentinel forwarding content to a directory.

Generate the integration pack

beacon endpoint sentinel install-pack --output ./beacon-sentinel-pack

The pack includes setup instructions, the BeaconRuntime_CL table schema, a DCR template for each path (dcr-template.json for Azure Monitor Agent, dcr-logs-ingestion-template.json for Vector), vector.toml, the DCR transform, starter hunting queries, example detection logic, and sample Beacon endpoint events.

Examples

Generate a content pack for the default per-user install:

Generate a content pack for the default per-user install

beacon endpoint sentinel install-pack --output ./beacon-sentinel-pack

Generate a content pack for a system-mode deployment:

Generate a content pack for a system-mode deployment

sudo /opt/beacon/bin/beacon endpoint sentinel install-pack \
  --system \
  --output ./beacon-sentinel-pack

Generate a content pack for a custom runtime log:

Generate a content pack for a custom runtime log

beacon endpoint sentinel install-pack \
  --output ./beacon-sentinel-pack \
  --log-path /path/to/runtime.jsonl

Flags

Flag	Description
`--output <dir>`	Output directory for the Microsoft Sentinel content pack. Defaults to `beacon-sentinel-pack`
`--user`	Use per-user endpoint paths. Enabled by default
`--system`	Use system endpoint paths and launch daemon
`--log-path <path>`	Runtime JSONL log path

beacon endpoint sentinel validate

beacon endpoint sentinel validate writes a Beacon validation event to the runtime JSONL log and prints the expected Microsoft Sentinel table and validation query.

Run the validation check

beacon endpoint sentinel validate

Examples

Write a validation event for the default per-user install:

Write a validation event for the default per-user install

beacon endpoint sentinel validate

Write a validation event for a system-mode deployment:

Write a validation event for a system-mode deployment

sudo /opt/beacon/bin/beacon endpoint sentinel validate --system

Write a validation event to a custom runtime log:

Write a validation event to a custom runtime log

beacon endpoint sentinel validate --log-path /path/to/runtime.jsonl

The validation command prints the expected Sentinel table and query:

Expected Sentinel table: BeaconRuntime_CL
Expected validation query: BeaconRuntime_CL | where Message has "Beacon endpoint Sentinel validation event"

Flags

Flag	Description
`--user`	Use per-user endpoint paths. Enabled by default
`--system`	Use system endpoint paths and launch daemon
`--log-path <path>`	Runtime JSONL log path

beacon endpoint sentinel forwarder

beacon endpoint sentinel forwarder install runs the Vector bundled with Beacon as a system service that sends every runtime log line to Microsoft Sentinel through the Logs Ingestion API. It works the same on macOS, Linux and Windows, and needs a system install and root (an elevated shell, or LocalSystem, on Windows). See Vector and the Logs Ingestion API for the Azure side.

Set up the forwarder with a certificate

sudo /opt/beacon/bin/beacon endpoint sentinel forwarder install --system \
  --endpoint https://<dcr>.<region>-1.ingest.monitor.azure.com \
  --dcr-immutable-id dcr-<32 hex digits> \
  --tenant-id <tenant ID> --client-id <app ID> \
  --client-certificate /path/to/app.pfx

Set up the forwarder with a client secret

printf '%s' "$CLIENT_SECRET" | sudo /opt/beacon/bin/beacon endpoint sentinel forwarder install --system \
  --endpoint https://<dcr>.<region>-1.ingest.monitor.azure.com \
  --dcr-immutable-id dcr-<32 hex digits> \
  --tenant-id <tenant ID> --client-id <app ID> --client-secret-stdin

The credential is never a command-line argument. Vector checks the config before anything changes, so a rejected install leaves a running forwarder as it was. Run install again to change a setting or rotate the credential.

Check and remove it

sudo /opt/beacon/bin/beacon endpoint sentinel forwarder status --system
sudo /opt/beacon/bin/beacon endpoint sentinel forwarder remove --system

status shows the settings, the service state and Vector’s latest warning. remove stops the service and deletes the settings and credential. Repair and package upgrades keep the forwarder; uninstall removes the service, and keeps the settings with --keep-config.

Flags

Flag	Description
`--system`	Required. The forwarder runs only with a system install
`--endpoint <url>`	The DCR’s logs ingestion URL, or a Data Collection Endpoint’s
`--dcr-immutable-id <id>`	The DCR’s immutable ID (`dcr-` and 32 hex digits)
`--tenant-id <id>`	Microsoft Entra tenant ID
`--client-id <id>`	App registration (client) ID
`--client-certificate <path>`	Authenticate with this PFX certificate. Its password, if any, comes from `AZURE_CLIENT_CERTIFICATE_PASSWORD` or stdin with `--certificate-password-stdin`
`--client-secret-stdin`	Read the client secret from stdin. Without it the secret comes from `AZURE_CLIENT_SECRET`
`--authority-host <url>`	Entra authority for a sovereign cloud, such as `https://login.microsoftonline.us`
`--read-from beginning\|end`	Where to start in a log not read before. `beginning`, the default, sends the current log once
`--vector <path>`	Vector binary to run. Defaults to the one Beacon’s package installed
`--json`	Print the result as JSON

Microsoft Sentinel forwarding

Configure Azure Monitor Agent or Vector, and Data Collection Rules, for Beacon events.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.

Install and Upgrade

CLI Resources

Command Manual

beacon endpoint sentinel

Forwarding command

Commands

beacon endpoint sentinel print-config

beacon endpoint sentinel install-pack

beacon endpoint sentinel validate

beacon endpoint sentinel forwarder

Runtime log paths

beacon endpoint sentinel print-config

Examples

Flags

beacon endpoint sentinel install-pack

Examples

Flags

beacon endpoint sentinel validate

Examples

Flags

beacon endpoint sentinel forwarder

Flags

Microsoft Sentinel forwarding

Log forwarding

Endpoint agent

Endpoint event schema

​Forwarding command

​Commands

beacon endpoint sentinel print-config

beacon endpoint sentinel install-pack

beacon endpoint sentinel validate

beacon endpoint sentinel forwarder

​Runtime log paths

​beacon endpoint sentinel print-config

​Examples

​Flags

​beacon endpoint sentinel install-pack

​Examples

​Flags

​beacon endpoint sentinel validate

​Examples

​Flags

​beacon endpoint sentinel forwarder

​Flags

​Related

Microsoft Sentinel forwarding

Log forwarding

Endpoint agent

Endpoint event schema

Forwarding command

Commands

Runtime log paths

beacon endpoint sentinel print-config

Examples

Flags

beacon endpoint sentinel install-pack

Examples

Flags

beacon endpoint sentinel validate

Examples

Flags

beacon endpoint sentinel forwarder

Flags

Related